Stories, and bit rot, from the IT Support Trenches

☰ Menu

NTLMSSP was returning the error “STATUS_MORE_PROCESSING_REQUIRED”

NTLMSSP is the security provider for NTLM, in case you were wondering. I learnt about it as I was trying to write a log file to a DFS share in a different domain, and I was getting a “Path not found” error.

The client computer could see the network folder it was trying to write to, so I started up PROCMON and watched the traffic. This was the error which occurred:

BAD NETWORK NAME

Wasn’t anything bad about that network name, so I connected up a network sniffer. It told me that NTLMSSP was returning STATUS_MORE_PROCESSING_REQUIRED message.

My friend Google, wasn’t of any help to me, so here is what I think was going wrong.

Background.The LogPath was pointing to a DFS share in the CENT domain. The TOLERDO and CONTOSO have cross-domain trusts, so their users can write to the CENT DFS share.

The problem. The DFS request meant that the TOLERDO user, accessing the CENT domain, needed their credentials validated against the TOLERDO domain.

This credential validation is exceeding some sort of SMB timeout, and throws a "STATUS_MORE_PROCESSING_REQUIRED" message.